URL encoder/decoder · Guide
Percent Encoding Decoder: Convert Percent Encoding to Text
Percent encoding is the mechanism behind URL encoding: every unsafe byte becomes a % followed by two hex digits. A percent encoding decoder reverses that, and reading the output correctly means knowing what those bytes were meant to be.
How the escapes map back to characters
Each %XX is one byte. Decoding collects those bytes and interprets the sequence as UTF-8, which is what RFC 3986 specifies for anything outside ASCII.
So %C3%A9 is two bytes forming é, and %E2%82%AC is three bytes forming €. A single escape like %E9 on its own is Latin-1 for é and is not valid UTF-8 — legacy systems produce these, and a strict decoder will reject them.
Spotting double encoding
If the decoded output still contains %XX escapes, the string was encoded twice. Decode again and you get the real value. The tell-tale marker is %25, which is an encoded percent sign.
%2520 decodes to %20 decodes to a space. Fix it at the source rather than decoding twice in production code — repeated decoding is a known path to security bugs, because a filter sees one value and the backend sees another.
Malformed input
A % that is not followed by two hex digits is invalid. Strict decoders throw; lenient ones pass the % through untouched. Neither behaviour is wrong, but they disagree, which is exactly the kind of gap that causes parser-confusion bugs.
Truncated escapes are common when a URL was cut to fit a log column or a database field. If a decode fails on the last few characters, check whether the input was clipped.
Decoding safely in the browser
Percent-encoded strings routinely carry session tokens, search terms and redirect targets. Our decoder runs locally, so those values are never transmitted while you inspect them.
One habit worth keeping: never take a decoded value and put it straight into HTML or a redirect. Decoding removes the encoding that was protecting you, so re-escape for the destination context — HTML-escape for markup, validate against an allowlist for redirects.
Frequently asked questions
Is percent encoding the same as URL encoding?
Yes — percent encoding is the formal name in RFC 3986; URL encoding is the everyday term for applying it to URLs.
Why does one character decode into several escapes?
Non-ASCII characters are encoded as their UTF-8 bytes, and one character can be two to four bytes, so it becomes two to four escapes.
What does %25 mean?
A literal percent sign. Seeing it in a URL usually signals that the value was percent-encoded more than once.
Ready to try it?
Open the free browser-based URL encoder/decoder and apply what you just read — no sign-up, runs locally.
Open the URL encoder/decoder tool